[3ae81e1] | 1 | <?xml version="1.0" encoding="ISO-8859-1"?>
|
---|
| 2 | <!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
|
---|
| 3 | "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
|
---|
| 4 | <!ENTITY % general-entities SYSTEM "../../general.ent">
|
---|
| 5 | %general-entities;
|
---|
| 6 | ]>
|
---|
| 7 |
|
---|
| 8 | <sect1 id="postlfs-firmware" xreflabel="About Firmware">
|
---|
| 9 | <?dbhtml filename="firmware.html"?>
|
---|
| 10 |
|
---|
| 11 | <sect1info>
|
---|
[d027410] | 12 | <date>$Date$</date>
|
---|
[3ae81e1] | 13 | </sect1info>
|
---|
| 14 |
|
---|
| 15 | <title>About Firmware</title>
|
---|
| 16 |
|
---|
| 17 | <indexterm zone="postlfs-firmware">
|
---|
| 18 | <primary sortas="e-lib-firmware">/lib/firmware</primary>
|
---|
| 19 | </indexterm>
|
---|
| 20 |
|
---|
[81a73ed8] | 21 | <para>
|
---|
| 22 | On some recent PCs it can be necessary, or desirable, to load firmware
|
---|
| 23 | to make them work at their best. There is a directory, <filename
|
---|
| 24 | class="directory">/lib/firmware</filename>, where the kernel or kernel
|
---|
| 25 | drivers look for firmware images.
|
---|
| 26 | </para>
|
---|
| 27 |
|
---|
| 28 | <para>
|
---|
| 29 | Currently, most firmware can be found at a <userinput>git</userinput>
|
---|
| 30 | repository: <ulink url=
|
---|
| 31 | "http://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git/tree/"/>.
|
---|
| 32 | For convenience, the LFS Project has created a mirror, updated daily, where
|
---|
| 33 | these firmware files can be accessed via <userinput>wget</userinput> or a
|
---|
| 34 | web browser at <ulink url="&sources-anduin-http;/linux-firmware/"/>.
|
---|
| 35 | </para>
|
---|
| 36 |
|
---|
| 37 | <para>
|
---|
| 38 | To get the firmware, either point a browser to one of the above
|
---|
| 39 | repositories and then download the item(s) which you need, or install
|
---|
| 40 | <xref linkend="git"/> and clone that repository.
|
---|
| 41 | </para>
|
---|
| 42 |
|
---|
| 43 | <para>
|
---|
| 44 | For some other firmware, particularly for Intel microcode and certain
|
---|
| 45 | wifi devices, the needed firmware is not available in the above repository.
|
---|
| 46 | Some of this will be addressed below, but a search of the Internet for
|
---|
| 47 | needed firmware is sometimes necessary.
|
---|
| 48 | </para>
|
---|
| 49 |
|
---|
| 50 | <para>
|
---|
| 51 | Firmware files are conventionally referred to as blobs because you cannot
|
---|
| 52 | determine what they will do. Note that firmware is distributed under
|
---|
| 53 | various different licenses which do not permit disassembly or
|
---|
| 54 | reverse-engineering.
|
---|
| 55 | </para>
|
---|
| 56 |
|
---|
| 57 | <para>
|
---|
| 58 | Firmware for PCs falls into four categories:
|
---|
| 59 | </para>
|
---|
[3ae81e1] | 60 |
|
---|
| 61 | <itemizedlist spacing="compact">
|
---|
| 62 | <listitem>
|
---|
[81a73ed8] | 63 | <para>
|
---|
| 64 | Updates to the CPU to work around errata, usually referred to as
|
---|
| 65 | microcode.
|
---|
| 66 | </para>
|
---|
[3ae81e1] | 67 | </listitem>
|
---|
| 68 | <listitem>
|
---|
[81a73ed8] | 69 | <para>
|
---|
[3179c69] | 70 | Firmware for video controllers. On x86 machines this is required for
|
---|
| 71 | ATI devices (Radeon and AMDGPU chips) and may be useful for Intel (Skylake
|
---|
| 72 | and later) and Nvidia (Kepler and later) GPUs.
|
---|
| 73 | </para>
|
---|
| 74 |
|
---|
| 75 | <para>
|
---|
| 76 | ATI Radeon and AMGPU devices all require firmware to be able to use KMS
|
---|
[81a73ed8] | 77 | (kernel modesetting - the preferred option) as well as for Xorg. For
|
---|
[3179c69] | 78 | old radeon chips (before the R600), the firmware is still in the
|
---|
| 79 | kernel source.
|
---|
| 80 | </para>
|
---|
| 81 |
|
---|
| 82 | <para>
|
---|
| 83 | Intel integrated GPUs from Skylake onwards can use firmware for GuC
|
---|
| 84 | (the Graphics microcontroller), and also for the HuC (HEVC/H265
|
---|
| 85 | microcontroller which offloads to the GPU) and the DMC (Display
|
---|
| 86 | Microcontroller) to provide additional low-power states. The GuC and
|
---|
| 87 | HuC have had a chequered history in the kernel and updated firmware
|
---|
| 88 | may be disabled by default, depending on your kernel version. Further
|
---|
| 89 | details may be found at <ulink
|
---|
| 90 | url="https://01.org/linuxgraphics/downloads/firmware/">01.org</ulink>
|
---|
| 91 | and <ulink
|
---|
[14cec0f] | 92 | url="https://wiki.archlinux.org/index.php/intel_graphics">Arch
|
---|
[3179c69] | 93 | linux</ulink>.
|
---|
| 94 | </para>
|
---|
| 95 |
|
---|
| 96 | <para>
|
---|
| 97 | Nvidia GPUs from Kepler onwards require signed firmware, otherwise the
|
---|
| 98 | nouveau driver is unable to provide hardware acceleration. Nvidia has
|
---|
| 99 | now released firmware up to Turing (most, maybe all, GTX16xx and RTX20xx
|
---|
| 100 | GPUs) to linux-firmware, and kernels from linux-5.6 should support it,
|
---|
| 101 | although Mesa support may require a development version until Mesa-20.2
|
---|
| 102 | is released. Note that faster clocks than the default are not enabled
|
---|
| 103 | by the released firmware.
|
---|
[81a73ed8] | 104 | </para>
|
---|
[3ae81e1] | 105 | </listitem>
|
---|
| 106 | <listitem>
|
---|
[81a73ed8] | 107 | <para>
|
---|
| 108 | Firmware updates for wired network ports. Mostly they work even
|
---|
| 109 | without the updates, but probably they will work better with
|
---|
| 110 | the updated firmware. For some modern laptops, firmware for both
|
---|
| 111 | wired ethernet (e.g. rtl_nic) and also for bluetooth devices (e.g. qca)
|
---|
| 112 | is <emphasis>required</emphasis> before the wired network can be used.
|
---|
[89bdbf8] | 113 | </para>
|
---|
[3ae81e1] | 114 | </listitem>
|
---|
| 115 | <listitem>
|
---|
[81a73ed8] | 116 | <para>
|
---|
| 117 | Firmware for other devices, such as wifi. These devices are not
|
---|
| 118 | required for the PC to boot, but need the firmware before these devices
|
---|
| 119 | can be used.
|
---|
| 120 | </para>
|
---|
[3ae81e1] | 121 | </listitem>
|
---|
| 122 | </itemizedlist>
|
---|
| 123 |
|
---|
[81a73ed8] | 124 | <note>
|
---|
| 125 | <para>
|
---|
| 126 | Although not needed to load a firmware blob, the following
|
---|
| 127 | tools may be useful for determining, obtaining, or preparing the needed
|
---|
| 128 | firmware in order to load it into the system:
|
---|
| 129 | <xref linkend="cpio"/>,
|
---|
| 130 | <xref linkend="git"/>,
|
---|
| 131 | <xref linkend="pciutils"/>, and
|
---|
| 132 | <xref linkend="wget"/>
|
---|
| 133 | </para>
|
---|
| 134 | </note>
|
---|
[3ae81e1] | 135 |
|
---|
| 136 | <para condition="html" role="usernotes">User Notes:
|
---|
| 137 | <ulink url="&blfs-wiki;/aboutfirmware"/></para>
|
---|
| 138 |
|
---|
| 139 | <sect2 id="cpu-microcode">
|
---|
| 140 | <title>Microcode updates for CPUs</title>
|
---|
| 141 |
|
---|
[81a73ed8] | 142 | <para>
|
---|
| 143 | In general, microcode can be loaded by the BIOS or UEFI, and it might be
|
---|
| 144 | updated by upgrading to a newer version of those. On linux, you can also
|
---|
| 145 | load the microcode from the kernel if you are using an AMD family 10h or
|
---|
| 146 | later processor (first introduced late 2007), or an Intel processor from
|
---|
| 147 | 1998 and later (Pentium4, Core, etc), if updated microcode has been
|
---|
| 148 | released. These updates only last until the machine is powered off, so
|
---|
| 149 | they need to be applied on every boot.
|
---|
| 150 | </para>
|
---|
| 151 |
|
---|
| 152 | <para>
|
---|
[bd78d011] | 153 | Intel provide updates of their microcode for Skylake and later
|
---|
[83d1722c] | 154 | processors as new vulnerabilities come to light, and have in the past
|
---|
| 155 | provided updates for processors from SandyBridge onwards, although those
|
---|
| 156 | are no-longer supported for new fixes. New versions of AMD
|
---|
[81a73ed8] | 157 | firmware are rare and usually only apply to a few models, although
|
---|
| 158 | motherboard manufacturers get extra updates which maybe update microcode
|
---|
| 159 | along with the changes to support newer CPUs and faster memory.
|
---|
| 160 | </para>
|
---|
| 161 |
|
---|
| 162 | <para>
|
---|
| 163 | There are two ways of loading the microcode, described as 'early' and
|
---|
| 164 | 'late'. Early loading happens before userspace has been started, late
|
---|
| 165 | loading happens after userspace has started. Not surprisingly, early
|
---|
| 166 | loading is preferred, (see e.g. an explanatory comment in a kernel
|
---|
| 167 | commit noted at <ulink url="https://lwn.net/Articles/530346/">
|
---|
| 168 | x86/microcode: Early load microcode</ulink> on LWN.) Indeed, it
|
---|
| 169 | is needed to work around one particular erratum in early Intel Haswell
|
---|
| 170 | processors which had TSX enabled. (See <ulink url=
|
---|
| 171 | "http://www.anandtech.com/show/8376/intel-disables-tsx-instructions-erratum-found-in-haswell-haswelleep-broadwellyi/">
|
---|
| 172 | Intel Disables TSX Instructions: Erratum Found in Haswell,
|
---|
| 173 | Haswell-E/EP, Broadwell-Y
|
---|
| 174 | </ulink>.) Without this update glibc can do the wrong thing in uncommon
|
---|
| 175 | situations.
|
---|
| 176 | </para>
|
---|
| 177 |
|
---|
| 178 | <para>
|
---|
| 179 | It is still possible to manually force late loading of microcode, either
|
---|
| 180 | for testing or to prevent having to reboot. You will need to reconfigure
|
---|
| 181 | your kernel for either method. The instructions here will create a
|
---|
| 182 | kernel <filename>.config</filename> to suite early loading, before
|
---|
| 183 | forcing late loading to see if there is any microcode. If there is,
|
---|
| 184 | the instructions then show you how to create an initrd for early loading.
|
---|
| 185 | </para>
|
---|
| 186 |
|
---|
| 187 | <para>
|
---|
| 188 | To confirm what processor(s) you have (if more than one, they will be
|
---|
| 189 | identical) look in /proc/cpuinfo.
|
---|
| 190 | </para>
|
---|
[3ae81e1] | 191 |
|
---|
[83d1722c] | 192 | <para>
|
---|
| 193 | If you are creating an initrd to update firmware for different machines,
|
---|
| 194 | as a distro would do, go down to 'Early loading of microcode' and cat all
|
---|
| 195 | the Intel blobs to GenuineIntel.bin or cat all the AMD blobs to
|
---|
| 196 | AuthenticAMD.bin. This creates a larger initrd - for all Intel machines in
|
---|
| 197 | the 20200609 update the size is 3.0 MB compared to typically 24 KB for one
|
---|
| 198 | machine.
|
---|
| 199 | </para>
|
---|
| 200 |
|
---|
[3ae81e1] | 201 | <sect3 id="intel-microcode">
|
---|
| 202 | <title>Intel Microcode for the CPU</title>
|
---|
[ba78ebe2] | 203 |
|
---|
[81a73ed8] | 204 | <para>
|
---|
| 205 | The first step is to get the most recent version of the Intel
|
---|
| 206 | microcode. This must be done by navigating to <ulink url=
|
---|
[3179c69] | 207 | 'https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/'/>
|
---|
[81a73ed8] | 208 | and downloading the latest file there. As of this writing the most
|
---|
[3179c69] | 209 | secure version of the microcode, for those machines which can boot it,
|
---|
[428cad4] | 210 | is microcode-20210608.<!-- If you have a Skylake machine, please read the
|
---|
[bd78d011] | 211 | Caution in the 'Early loading of microcode' section below.--> Extract this
|
---|
[81a73ed8] | 212 | file in the normal way, the microcode is in the <filename>intel-ucode
|
---|
| 213 | </filename> directory, containing various blobs with names in the form
|
---|
| 214 | XX-YY-ZZ. There are also various other files, and a releasenote.
|
---|
| 215 | </para>
|
---|
| 216 |
|
---|
| 217 | <para>
|
---|
| 218 | In the past, intel did not provide any details of which blobs had
|
---|
| 219 | changed versions, but now the release note details this.
|
---|
| 220 | </para>
|
---|
| 221 |
|
---|
| 222 | <para>
|
---|
| 223 | The recent firmware for older processors is provided to deal with
|
---|
| 224 | vulnerabilities which have now been made public, and for some of these
|
---|
| 225 | such as Microarchitectural Data Sampling (MDS) you might wish to
|
---|
| 226 | increase the protection by disabling hyperthreading, or alternatively
|
---|
| 227 | to disable the kernel's default mitigation because of its impact on
|
---|
| 228 | compile times. Please read the online documentation at <ulink url=
|
---|
| 229 | 'https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html'/>.
|
---|
| 230 | </para>
|
---|
| 231 |
|
---|
[bd78d011] | 232 | <!-- commented, I don't think there is a new listed item for 2011-11 vulns
|
---|
| 233 | (platypus etc : intel-sa-00381 and 0389)
|
---|
| 234 | and anyway the very latest stable releases have backports : ken
|
---|
[81a73ed8] | 235 | <para>
|
---|
[83d1722c] | 236 | The documentation on the latest SRBDS (Special Register Buffer Data
|
---|
| 237 | Sampling) vulnerabilities/fixes will be documented in kernels 5.4.46,
|
---|
| 238 | 5.6.18, 5.7.2, 5.8.0 and later.
|
---|
[bd78d011] | 239 | </para>-->
|
---|
[81a73ed8] | 240 |
|
---|
| 241 | <para>
|
---|
| 242 | Now you need to determine your processor's identity to see if there
|
---|
| 243 | is any microcode for it. Determine the decimal values of the cpu family,
|
---|
| 244 | model and stepping by running the following command (it will also report
|
---|
| 245 | the current microcode version):
|
---|
| 246 | </para>
|
---|
[3ae81e1] | 247 |
|
---|
| 248 | <screen><userinput>head -n7 /proc/cpuinfo</userinput></screen>
|
---|
| 249 |
|
---|
[81a73ed8] | 250 | <para>
|
---|
| 251 | Convert the cpu family, model and stepping to pairs of hexadecimal
|
---|
| 252 | digits. For a Skylake i3 6100 (described as Intel(R) Core(TM) i3-6100
|
---|
| 253 | CPU) the relevant values are cpu family 6, model 94, stepping 3 so in
|
---|
| 254 | this case the required identification is 06-5e-03. A look at the blobs
|
---|
| 255 | will show that there is one for this CPU (although for older issues it
|
---|
| 256 | might have already been applied by the BIOS). If there is a blob for
|
---|
| 257 | your system then test if it will be applied by copying it (replace
|
---|
| 258 | <XX-YY-ZZ> by the identifier for your CPU) to where the
|
---|
| 259 | kernel can find it:
|
---|
| 260 | </para>
|
---|
[3ae81e1] | 261 |
|
---|
| 262 | <screen><userinput>mkdir -pv /lib/firmware/intel-ucode
|
---|
[ba78ebe2] | 263 | cp -v intel-ucode/<XX-YY-ZZ> /lib/firmware/intel-ucode</userinput></screen>
|
---|
[3ae81e1] | 264 |
|
---|
[81a73ed8] | 265 | <para>
|
---|
| 266 | Now that the Intel microcode has been prepared, use the following
|
---|
| 267 | options when you configure the kernel to load Intel microcode:
|
---|
| 268 | </para>
|
---|
[3ae81e1] | 269 |
|
---|
[0576c595] | 270 | <screen><literal>General Setup --->
|
---|
[f39cf0d0] | 271 | [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support [CONFIG_BLK_DEV_INITRD]
|
---|
[0576c595] | 272 | Processor type and features --->
|
---|
[f39cf0d0] | 273 | [*] CPU microcode loading support [CONFIG_MICROCODE]
|
---|
| 274 | [*] Intel microcode loading support [CONFIG_MICROCODE_INTEL]</literal></screen>
|
---|
[0576c595] | 275 |
|
---|
[81a73ed8] | 276 | <para>
|
---|
| 277 | After you have successfully booted the new system, force late loading
|
---|
| 278 | by using the command:
|
---|
| 279 | </para>
|
---|
[0576c595] | 280 |
|
---|
| 281 | <screen><userinput>echo 1 > /sys/devices/system/cpu/microcode/reload</userinput></screen>
|
---|
| 282 |
|
---|
[81a73ed8] | 283 | <para>
|
---|
| 284 | Then use the following command to see if anything was loaded:
|
---|
[83d1722c] | 285 | (N.B. the dates when microcode was created may be months ahead of when
|
---|
| 286 | it was released.)
|
---|
[81a73ed8] | 287 | </para>
|
---|
[0576c595] | 288 |
|
---|
| 289 | <screen><userinput>dmesg | grep -e 'microcode' -e 'Linux version' -e 'Command line'</userinput></screen>
|
---|
| 290 |
|
---|
[81a73ed8] | 291 | <para>
|
---|
[bd78d011] | 292 | This reformatted example for a machine with old microcode in its BIOS
|
---|
[83d1722c] | 293 | was created by temporarily booting without
|
---|
[bd78d011] | 294 | microcode, to show the current Firmware Bug messages, then the late load
|
---|
[428cad4] | 295 | shows it being updated to revision 0xea.
|
---|
[81a73ed8] | 296 | </para>
|
---|
[c6ebc90b] | 297 |
|
---|
[428cad4] | 298 | <screen><literal>[ 0.000000] Linux version 5.12.8 (lfs@leshp) (gcc (GCC) 11.1.0,
|
---|
| 299 | GNU ld (GNU Binutils) 2.36.1)
|
---|
| 300 | #2 SMP PREEMPT Fri Jun 4 01:25:02 BST 2021
|
---|
| 301 | [ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-5.12.8-sda11 root=/dev/sda11 ro
|
---|
| 302 | resume=/dev/sda10
|
---|
| 303 | [ 0.028741] [Firmware Bug]: TSC_DEADLINE disabled due to Errata;
|
---|
[bd78d011] | 304 | please update microcode to version: 0xb2 (or later)
|
---|
[428cad4] | 305 | [ 0.115716] SRBDS: Vulnerable: No microcode
|
---|
| 306 | [ 0.115826] MDS: Vulnerable: Clear CPU buffers attempted, no microcode
|
---|
| 307 | [ 0.389005] microcode: sig=0x506e3, pf=0x2, revision=0x74
|
---|
| 308 | [ 0.389030] microcode: Microcode Update Driver: v2.2.
|
---|
| 309 | [ 70.089502] microcode: updated to revision 0xea, date = 2021-01-25
|
---|
| 310 | [ 70.089528] x86/CPU: CPU features have changed after loading microcode,
|
---|
| 311 | but might not take effect.
|
---|
| 312 | [ 70.089530] microcode: Reload completed, microcode revision: 0xea</literal></screen>
|
---|
[3ae81e1] | 313 |
|
---|
[81a73ed8] | 314 | <para>
|
---|
| 315 | If the microcode was not updated, there is no new microcode for this
|
---|
| 316 | system's processor. If it did get updated, you can now proceed to
|
---|
| 317 | <xref linkend='early-microcode'/>.
|
---|
| 318 | </para>
|
---|
[3ae81e1] | 319 |
|
---|
| 320 | </sect3>
|
---|
| 321 |
|
---|
[bd78d011] | 322 | <sect3 id="amd-microcode">
|
---|
[3ae81e1] | 323 | <title>AMD Microcode for the CPU</title>
|
---|
| 324 |
|
---|
[81a73ed8] | 325 | <para>
|
---|
| 326 | Begin by downloading a container of firmware for your CPU family
|
---|
| 327 | from <ulink url=
|
---|
| 328 | '&sources-anduin-http;/linux-firmware/amd-ucode/'/>.
|
---|
| 329 | The family is always specified in hex. Families 10h to 14h (16 to 20)
|
---|
| 330 | are in microcode_amd.bin. Families 15h, 16h and 17h have their own
|
---|
| 331 | containers. Create the required directory and put the firmware you
|
---|
| 332 | downloaded into it as the <systemitem
|
---|
| 333 | class="username">root</systemitem> user:
|
---|
| 334 | </para>
|
---|
[3ae81e1] | 335 |
|
---|
| 336 | <screen><userinput>mkdir -pv /lib/firmware/amd-ucode
|
---|
| 337 | cp -v microcode_amd* /lib/firmware/amd-ucode</userinput></screen>
|
---|
| 338 |
|
---|
[81a73ed8] | 339 | <para>
|
---|
| 340 | When you configure the kernel, use the following options
|
---|
| 341 | to load AMD microcode:
|
---|
| 342 | </para>
|
---|
[0576c595] | 343 |
|
---|
| 344 | <screen><literal>General Setup --->
|
---|
[f39cf0d0] | 345 | [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support [CONFIG_BLK_DEV_INITRD]
|
---|
[0576c595] | 346 | Processor type and features --->
|
---|
[f39cf0d0] | 347 | [*] CPU microcode loading support [CONFIG_MICROCODE]
|
---|
| 348 | [*] AMD microcode loading support [CONFIG_MICROCODE_AMD]</literal></screen>
|
---|
[0576c595] | 349 |
|
---|
[81a73ed8] | 350 | <para>
|
---|
| 351 | After you have successfully booted the new system, force late loading
|
---|
| 352 | by using the command:
|
---|
| 353 | </para>
|
---|
[0576c595] | 354 |
|
---|
| 355 | <screen><userinput>echo 1 > /sys/devices/system/cpu/microcode/reload</userinput></screen>
|
---|
[3ae81e1] | 356 |
|
---|
[81a73ed8] | 357 | <para>
|
---|
| 358 | Then use the following command to see if anything was loaded:
|
---|
| 359 | </para>
|
---|
[3ae81e1] | 360 |
|
---|
[0576c595] | 361 | <screen><userinput>dmesg | grep -e 'microcode' -e 'Linux version' -e 'Command line'</userinput></screen>
|
---|
[81a73ed8] | 362 | <para>
|
---|
| 363 | This historic example from an old Athlon(tm) II X2 shows it has been
|
---|
| 364 | updated. At that time, all CPUs were still reported in the microcode
|
---|
| 365 | details on AMD machines (the current position for AMD machines where
|
---|
| 366 | newer microcode is available is unknown) :
|
---|
| 367 | </para>
|
---|
[3ae81e1] | 368 |
|
---|
[c6d338e] | 369 | <screen><literal>[ 0.000000] Linux version 4.15.3 (ken@testserver) (gcc version 7.3.0 (GCC))
|
---|
| 370 | #1 SMP Sun Feb 18 02:08:12 GMT 2018
|
---|
| 371 | [ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-4.15.3-sda5 root=/dev/sda5 ro
|
---|
| 372 | [ 0.307619] microcode: CPU0: patch_level=0x010000b6
|
---|
| 373 | [ 0.307671] microcode: CPU1: patch_level=0x010000b6
|
---|
| 374 | [ 0.307743] microcode: Microcode Update Driver: v2.2.
|
---|
| 375 | [ 187.928891] microcode: CPU0: new patch_level=0x010000c8
|
---|
| 376 | [ 187.928899] microcode: CPU1: new patch_level=0x010000c8</literal></screen>
|
---|
[3ae81e1] | 377 |
|
---|
[81a73ed8] | 378 | <para>
|
---|
| 379 | If the microcode was not updated, there is no new microcode for
|
---|
| 380 | this system's processor. If it did get updated, you can now proceed to
|
---|
| 381 | <xref linkend='early-microcode'/>.
|
---|
| 382 | </para>
|
---|
[3ae81e1] | 383 |
|
---|
| 384 | </sect3>
|
---|
| 385 |
|
---|
| 386 | <sect3 id="early-microcode">
|
---|
| 387 | <title>Early loading of microcode</title>
|
---|
| 388 |
|
---|
[81a73ed8] | 389 | <para>
|
---|
| 390 | If you have established that updated microcode is available for
|
---|
| 391 | your system, it is time to prepare it for early loading. This requires
|
---|
| 392 | an additional package, <xref linkend='cpio'/> and the creation of an
|
---|
| 393 | initrd which will need to be added to grub.cfg.
|
---|
| 394 | </para>
|
---|
[3ae81e1] | 395 |
|
---|
[81a73ed8] | 396 | <para>
|
---|
| 397 | It does not matter where you prepare the initrd, and once it is
|
---|
| 398 | working you can apply the same initrd to later LFS systems or newer
|
---|
| 399 | kernels on this same machine, at least until any newer microcode is
|
---|
| 400 | released. Use the following commands:
|
---|
| 401 | </para>
|
---|
[3ae81e1] | 402 |
|
---|
| 403 | <screen><userinput>mkdir -p initrd/kernel/x86/microcode
|
---|
| 404 | cd initrd</userinput></screen>
|
---|
| 405 |
|
---|
[81a73ed8] | 406 | <para>
|
---|
| 407 | For an AMD machine, use the following command (replace
|
---|
| 408 | <MYCONTAINER> with the name of the container for your CPU's
|
---|
| 409 | family):
|
---|
| 410 | </para>
|
---|
[3ae81e1] | 411 |
|
---|
[af8a78d] | 412 | <screen><userinput>cp -v /lib/firmware/amd-ucode/<MYCONTAINER> kernel/x86/microcode/AuthenticAMD.bin</userinput></screen>
|
---|
[3ae81e1] | 413 |
|
---|
[81a73ed8] | 414 | <para>
|
---|
| 415 | Or for an Intel machine copy the appropriate blob using this command:
|
---|
| 416 | </para>
|
---|
[3ae81e1] | 417 |
|
---|
| 418 | <screen><userinput>cp -v /lib/firmware/intel-ucode/<XX-YY-ZZ> kernel/x86/microcode/GenuineIntel.bin</userinput></screen>
|
---|
| 419 |
|
---|
[bd78d011] | 420 | <!-- new version from 20201110 release onwards, assumed to work on all skylakes
|
---|
| 421 | But complaints about previous version took some days to appear, so keep as a comment for now.
|
---|
[fe2553a] | 422 | <caution>
|
---|
| 423 | <para>
|
---|
[3179c69] | 424 | On some Skylake machines with hex Model Number '4e' (78 decimal) the
|
---|
| 425 | upgrade to microcode version '0xdc' is reported to cause the machine to
|
---|
| 426 | hang in early boot, and the fix is to revert to version 0xd6 which was
|
---|
| 427 | first shipped in the 20191115 microcode release.
|
---|
[fe2553a] | 428 | </para>
|
---|
| 429 |
|
---|
| 430 | <para>
|
---|
[3179c69] | 431 | At least one model '5e' Skylake does boot successfully with version
|
---|
| 432 | 0xdc, but Intel has now shipped a 20200616 release which is intended for
|
---|
| 433 | distros which need an initrd that will boot on everyone's machine: it
|
---|
| 434 | reverts both Skylake variants ('4e' and '5e') to the old 0xd6.
|
---|
[fe2553a] | 435 | </para>
|
---|
| 436 |
|
---|
| 437 | <para>
|
---|
[3179c69] | 438 | For a Skylake which does not boot with 0xdc, reverting to 0xd6 will make
|
---|
| 439 | the machine usable, but without the SRBDS mitigations.
|
---|
[fe2553a] | 440 | </para>
|
---|
[bd78d011] | 441 | </caution>-->
|
---|
[fe2553a] | 442 |
|
---|
[81a73ed8] | 443 | <para>
|
---|
| 444 | Now prepare the initrd:
|
---|
| 445 | </para>
|
---|
[3ae81e1] | 446 |
|
---|
| 447 | <screen><userinput>find . | cpio -o -H newc > /boot/microcode.img</userinput></screen>
|
---|
| 448 |
|
---|
[81a73ed8] | 449 | <para>
|
---|
| 450 | You now need to add a new entry to /boot/grub/grub.cfg and
|
---|
| 451 | here you should add a new line after the linux line within the stanza.
|
---|
| 452 | If /boot is a separate mountpoint:
|
---|
| 453 | </para>
|
---|
[3ae81e1] | 454 |
|
---|
| 455 | <screen><userinput>initrd /microcode.img</userinput></screen>
|
---|
| 456 |
|
---|
[81a73ed8] | 457 | <para>
|
---|
| 458 | or this if it is not:
|
---|
| 459 | </para>
|
---|
[3ae81e1] | 460 |
|
---|
| 461 | <screen><userinput>initrd /boot/microcode.img</userinput></screen>
|
---|
| 462 |
|
---|
[81a73ed8] | 463 | <para>
|
---|
| 464 | If you are already booting with an initrd (see <xref
|
---|
| 465 | linkend="initramfs"/>), you should run <command>mkinitramfs</command>
|
---|
| 466 | again after putting the appropriate blob or container into <filename
|
---|
| 467 | class="directory">/lib/firmware</filename> as explained above.
|
---|
| 468 | Alternatively, you can have both initrd on the same line, such as
|
---|
| 469 | <userinput>initrd /microcode.img /other-initrd.img</userinput> (adapt
|
---|
| 470 | that as above if /boot is not a separate mountpoint).
|
---|
| 471 | </para>
|
---|
[a7c5f47] | 472 |
|
---|
[81a73ed8] | 473 | <para>
|
---|
| 474 | You can now reboot with the added initrd, and then use the same
|
---|
| 475 | command to check that the early load worked:
|
---|
| 476 | </para>
|
---|
[3ae81e1] | 477 |
|
---|
[0576c595] | 478 | <screen><userinput>dmesg | grep -e 'microcode' -e 'Linux version' -e 'Command line'</userinput></screen>
|
---|
| 479 |
|
---|
[81a73ed8] | 480 | <para>
|
---|
| 481 | If you updated to address vulnerabilities, you can look at <filename
|
---|
| 482 | class="directory">/sys/devices/system/cpu/vulnerabilities/</filename>
|
---|
| 483 | to see what is now reported.
|
---|
| 484 | </para>
|
---|
[3c19265] | 485 |
|
---|
[81a73ed8] | 486 | <para>
|
---|
| 487 | The places and times where early loading happens are very different
|
---|
[bd78d011] | 488 | in AMD and Intel machines. First, an Intel (Skylake) example with early loading:
|
---|
[81a73ed8] | 489 | </para>
|
---|
[b174fb1] | 490 |
|
---|
[428cad4] | 491 | <screen><literal>[ 0.000000] microcode: microcode updated early to revision 0xea, date = 2021-01-25
|
---|
| 492 | [ 0.000000] Linux version 5.12.8 (lfs@leshp) (gcc (GCC) 11.1.0,
|
---|
| 493 | GNU ld (GNU Binutils) 2.36.1) #2 SMP PREEMPT Fri Jun 4 01:25:02 BST 2021
|
---|
| 494 | [ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-5.12.8-sda11 root=/dev/sda11 ro
|
---|
| 495 | resume=/dev/sda10
|
---|
| 496 | [ 0.381420] microcode: sig=0x506e3, pf=0x2, revision=0xea
|
---|
| 497 | [ 0.381479] microcode: Microcode Update Driver: v2.2.</literal></screen>
|
---|
[83d1722c] | 498 |
|
---|
[0576c595] | 499 |
|
---|
[81a73ed8] | 500 | <para>
|
---|
| 501 | A historic AMD example:
|
---|
| 502 | </para>
|
---|
[0576c595] | 503 |
|
---|
[c6d338e] | 504 | <screen><literal>[ 0.000000] Linux version 4.15.3 (ken@testserver) (gcc version 7.3.0 (GCC))
|
---|
| 505 | #2 SMP Sun Feb 18 02:32:03 GMT 2018
|
---|
| 506 | [ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-4.15.3-sda5 root=/dev/sda5 ro
|
---|
| 507 | [ 0.307619] microcode: microcode updated early to new patch_level=0x010000c8
|
---|
| 508 | [ 0.307678] microcode: CPU0: patch_level=0x010000c8
|
---|
| 509 | [ 0.307723] microcode: CPU1: patch_level=0x010000c8
|
---|
| 510 | [ 0.307795] microcode: Microcode Update Driver: v2.2.</literal></screen>
|
---|
[3ae81e1] | 511 |
|
---|
| 512 | </sect3>
|
---|
| 513 |
|
---|
| 514 | </sect2>
|
---|
| 515 |
|
---|
[1cc5345] | 516 | <sect2 id="video-firmware">
|
---|
| 517 | <title>Firmware for Video Cards</title>
|
---|
| 518 |
|
---|
[81a73ed8] | 519 | <sect3 id="ati-video-firmware">
|
---|
| 520 | <title>Firmware for ATI video chips (R600 and later)</title>
|
---|
| 521 |
|
---|
| 522 | <para>
|
---|
| 523 | These instructions do NOT apply to old radeons before the R600
|
---|
| 524 | family. For those, the firmware is in the kernel's <filename
|
---|
| 525 | class='directory'>/lib/firmware/</filename> directory. Nor do they
|
---|
| 526 | apply if you intend to avoid a graphical setup such as Xorg and are
|
---|
| 527 | content to use the default 80x25 display rather than a framebuffer.
|
---|
| 528 | </para>
|
---|
| 529 |
|
---|
| 530 | <para>
|
---|
| 531 | Early radeon devices only needed a single 2K blob of firmware. Recent
|
---|
| 532 | devices need several different blobs, and some of them are much bigger.
|
---|
| 533 | The total size of the radeon firmware directory is over 500K —
|
---|
| 534 | on a large modern system you can probably spare the space, but it is
|
---|
| 535 | still redundant to install all the unused files each time you build
|
---|
| 536 | a system.
|
---|
| 537 | </para>
|
---|
| 538 |
|
---|
| 539 | <para>
|
---|
| 540 | A better approach is to install <xref linkend='pciutils'/> and then
|
---|
| 541 | use <userinput>lspci</userinput> to identify which VGA controller is
|
---|
| 542 | installed.
|
---|
| 543 | </para>
|
---|
| 544 |
|
---|
| 545 | <para>
|
---|
| 546 | With that information, check the RadeonFeature page of the Xorg wiki
|
---|
| 547 | for <ulink url="http://wiki.x.org/wiki/RadeonFeature/#index5h2">Decoder
|
---|
| 548 | ring for engineering vs marketing names</ulink> to identify the family
|
---|
| 549 | (you may need to know this for the Xorg driver in BLFS —
|
---|
| 550 | Southern Islands and Sea Islands use the radeonsi driver) and the
|
---|
| 551 | specific model.
|
---|
| 552 | </para>
|
---|
| 553 |
|
---|
| 554 | <para>
|
---|
| 555 | Now that you know which controller you are using, consult the
|
---|
| 556 | <ulink url="https://wiki.gentoo.org/wiki/Radeon#Firmware">
|
---|
| 557 | Radeon</ulink> page of the Gentoo wiki which has a table listing
|
---|
| 558 | the required firmware blobs for the various chipsets. Note that
|
---|
| 559 | Southern Islands and Sea Islands chips use different firmware for
|
---|
| 560 | kernel 3.17 and later compared to earlier kernels. Identify and
|
---|
| 561 | download the required blobs then install them:
|
---|
| 562 | </para>
|
---|
[3ae81e1] | 563 |
|
---|
| 564 | <screen><userinput>mkdir -pv /lib/firmware/radeon
|
---|
| 565 | cp -v <YOUR_BLOBS> /lib/firmware/radeon</userinput></screen>
|
---|
| 566 |
|
---|
[81a73ed8] | 567 | <para>
|
---|
| 568 | There are actually two ways of installing this firmware. BLFS, in the
|
---|
| 569 | 'Kernel Configuration for additional firmware' section part of the
|
---|
| 570 | <xref linkend="xorg-ati-driver"/> section gives an example of
|
---|
| 571 | compiling the firmware into the kernel - that is slightly faster to
|
---|
| 572 | load, but uses more kernel memory. Here we will use the alternative
|
---|
| 573 | method of making the radeon driver a module. In your kernel config
|
---|
| 574 | set the following:
|
---|
| 575 | </para>
|
---|
[3ae81e1] | 576 |
|
---|
| 577 | <screen><literal>Device Drivers --->
|
---|
| 578 | Graphics support --->
|
---|
| 579 | Direct Rendering Manager --->
|
---|
[f39cf0d0] | 580 | [*] Direct Rendering Manager (XFree86 ... support) [CONFIG_DRM]
|
---|
| 581 | [M] ATI Radeon [CONFIG_DRM_RADEON]</literal></screen>
|
---|
[3ae81e1] | 582 |
|
---|
[81a73ed8] | 583 | <para>
|
---|
| 584 | Loading several large blobs from /lib/firmware takes a noticeable
|
---|
| 585 | time, during which the screen will be blank. If you do not enable the
|
---|
| 586 | penguin framebuffer logo, or change the console size by using a bigger
|
---|
| 587 | font, that probably does not matter. If desired, you can slightly
|
---|
| 588 | reduce the time if you follow the alternate method of specifying 'y'
|
---|
| 589 | for CONFIG_DRM_RADEON covered in BLFS at the link above — you
|
---|
| 590 | must specify each needed radeon blob if you do that.
|
---|
| 591 | </para>
|
---|
[3ae81e1] | 592 |
|
---|
[81a73ed8] | 593 | </sect3>
|
---|
[1cc5345] | 594 |
|
---|
[81a73ed8] | 595 | <sect3 id="nvidia-video-firmware">
|
---|
| 596 | <title>Firmware for Nvidia video chips</title>
|
---|
[1cc5345] | 597 |
|
---|
[81a73ed8] | 598 | <para>
|
---|
| 599 | Some Nvidia graphics chips need firmware updates to take advantage
|
---|
| 600 | of all the card's capability. These are generally the GeForce 8, 9,
|
---|
| 601 | 9300, and 200-900 series chips. For more exact information, see
|
---|
| 602 | <ulink url=
|
---|
| 603 | "https://nouveau.freedesktop.org/wiki/VideoAcceleration/#firmware"/>.
|
---|
| 604 | </para>
|
---|
[1cc5345] | 605 |
|
---|
[81a73ed8] | 606 | <para>
|
---|
| 607 | First, the kernel Nvidia driver must be activated:
|
---|
| 608 | </para>
|
---|
[1cc5345] | 609 |
|
---|
| 610 | <screen><literal>Device Drivers --->
|
---|
| 611 | Graphics support --->
|
---|
| 612 | Direct Rendering Manager --->
|
---|
| 613 | <*> Direct Rendering Manager (XFree86 ... support) [CONFIG_DRM]
|
---|
[f39cf0d0] | 614 | <*/M> Nouveau (NVIDIA) cards [CONFIG_DRM_NOUVEAU]</literal></screen>
|
---|
[1cc5345] | 615 |
|
---|
[81a73ed8] | 616 | <para>
|
---|
| 617 | The steps to install the Nvidia firmware are:
|
---|
| 618 | </para>
|
---|
[1cc5345] | 619 |
|
---|
| 620 | <screen><userinput>wget https://raw.github.com/imirkin/re-vp2/master/extract_firmware.py
|
---|
| 621 | wget http://us.download.nvidia.com/XFree86/Linux-x86/325.15/NVIDIA-Linux-x86-325.15.run
|
---|
| 622 | sh NVIDIA-Linux-x86-325.15.run --extract-only
|
---|
| 623 | python extract_firmware.py
|
---|
| 624 | mkdir -p /lib/firmware/nouveau
|
---|
| 625 | cp -d nv* vuc-* /lib/firmware/nouveau/</userinput></screen>
|
---|
| 626 |
|
---|
[81a73ed8] | 627 | </sect3>
|
---|
[3ae81e1] | 628 | </sect2>
|
---|
| 629 |
|
---|
| 630 | <sect2 id="nic-firmware">
|
---|
| 631 | <title>Firmware for Network Interfaces</title>
|
---|
| 632 |
|
---|
[81a73ed8] | 633 | <para>
|
---|
| 634 | The kernel likes to load firmware for some network drivers, particularly
|
---|
| 635 | those from Realtek (the /lib/linux-firmware/rtl_nic/) directory, but
|
---|
| 636 | they generally appear to work without it. Therefore, you can boot the
|
---|
| 637 | kernel, check dmesg for messages about this missing firmware, and if
|
---|
| 638 | necessary download the firmware and put it in the specified directory in
|
---|
| 639 | <filename class="directory">/lib/firmware</filename> so that it will
|
---|
| 640 | be found on subsequent boots. Note that with current kernels this
|
---|
| 641 | works whether or not the driver is compiled in or built as a module,
|
---|
| 642 | there is no need to build this firmware into the kernel.
|
---|
| 643 | Here is an example where the R8169 driver has been compiled in but the
|
---|
| 644 | firmware was not made available. Once the firmware had been provided,
|
---|
| 645 | there was no mention of it on later boots.
|
---|
| 646 | </para>
|
---|
[3ae81e1] | 647 |
|
---|
| 648 | <screen><literal>dmesg | grep firmware | grep r8169
|
---|
| 649 | [ 7.018028] r8169 0000:01:00.0: Direct firmware load for rtl_nic/rtl8168g-2.fw failed with error -2
|
---|
| 650 | [ 7.018036] r8169 0000:01:00.0 eth0: unable to load firmware patch rtl_nic/rtl8168g-2.fw (-2)</literal></screen>
|
---|
| 651 |
|
---|
| 652 | </sect2>
|
---|
| 653 |
|
---|
| 654 | <sect2 id="other-firmware">
|
---|
| 655 | <title>Firmware for Other Devices</title>
|
---|
| 656 |
|
---|
[81a73ed8] | 657 | <para>
|
---|
| 658 | Identifying the correct firmware will typically require you to install
|
---|
| 659 | <xref linkend='pciutils'/>, and then use <userinput>lspci</userinput>
|
---|
| 660 | to identify the device. You should then search online to check which
|
---|
| 661 | module it uses, which firmware, and where to obtain the firmware —
|
---|
| 662 | not all of it is in linux-firmware.
|
---|
| 663 | </para>
|
---|
| 664 |
|
---|
| 665 | <para>
|
---|
| 666 | If possible, you should begin by using a wired connection when you first
|
---|
| 667 | boot your LFS system. To use a wireless connection you will need to
|
---|
| 668 | use a network tools such as <xref linkend='wireless_tools'/> and <xref
|
---|
| 669 | linkend='wpa_supplicant'/>.
|
---|
| 670 | </para>
|
---|
| 671 |
|
---|
[c18f6acb] | 672 | <para>
|
---|
| 673 | Different countries have different regulations on the radio spectrum
|
---|
| 674 | usage of wireless devices. You can install a firmware to make the
|
---|
| 675 | wireless devices obey local spectrum regulations, so you won't be
|
---|
| 676 | inquired by local authority or find your wireless NIC jamming the
|
---|
| 677 | frequencies of other devices (for example, remote controllers).
|
---|
| 678 | The regulatory database firmware can be downloaded from
|
---|
| 679 | <ulink url = 'https://kernel.org/pub/software/network/wireless-regdb/'/>.
|
---|
| 680 | To install it, simply extract <filename>regulatory.db</filename> and
|
---|
| 681 | <filename>regulatory.db.p7s</filename> from the tarball into
|
---|
| 682 | <filename class="directory">/lib/firmware</filename>.
|
---|
| 683 | The access point would send a country code to your wireless NIC,
|
---|
| 684 | and <xref linkend='wpa_supplicant'/> would tell the kernel to load
|
---|
| 685 | the regulation of this country from
|
---|
| 686 | <filename>regulatory.db</filename>, and enforce it.
|
---|
| 687 | </para>
|
---|
| 688 |
|
---|
[81a73ed8] | 689 | <para>
|
---|
| 690 | Firmware may also be needed for other devices such as some SCSI
|
---|
| 691 | controllers, bluetooth adaptors, or TV recorders. The same principles
|
---|
| 692 | apply.
|
---|
| 693 | </para>
|
---|
[3ae81e1] | 694 |
|
---|
| 695 | </sect2>
|
---|
| 696 |
|
---|
| 697 | </sect1>
|
---|